Bump js-yaml and mocha

[dependabot]

Bumps js-yaml to 4.3.1 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• Additional commits viewable in compare view

Updates mocha from 7.1.2 to 11.8.0

Release notes

Sourced from mocha's releases.

v11.8.0

11.8.0 (2026-08-02)

🌟 Features

• add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

• add modern Netlify to v11.x branch (#6082) (26deb23), closes #5696
• change site title to Mocha 11, update index note (#6086) (1f44d5f)
• CI: bump Node from 22 to 24 in publish action (#6206) (05aec43)

v11.7.7

11.7.7 (2026-06-13)

🩹 Fixes

• surface ts-node compile errors (#6045) (3477563)

v11.7.6

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

v11.7.5

11.7.5 (2025-11-04)

🩹 Fixes

• swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

• run tests on PRs for and pushes to v11.x (#5525) (8b21b38)

... (truncated)

Changelog

Sourced from mocha's changelog.

11.8.0 (2026-08-02)

🌟 Features

• add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

• add modern Netlify to v11.x branch (#6082) (26deb23), closes #5696
• change site title to Mocha 11, update index note (#6086) (1f44d5f)
• CI: bump Node from 22 to 24 in publish action (#6206) (05aec43)

11.7.7 (2026-06-13)

🩹 Fixes

• surface ts-node compile errors (#6045) (3477563)

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

11.7.5 (2025-11-04)

🩹 Fixes

• swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

• run tests on PRs for and pushes to v11.x (#5525) (8b21b38)
• setup release-please for v11 (#5522) (663fff4)

11.7.4 (2025-10-01)

... (truncated)

Commits

• 90c1bb3 chore(v11.x): release 11.8.0 (#6076)
• 05aec43 chore(CI): bump Node from 22 to 24 in publish action (#6206)
• 1f44d5f chore: change site title to Mocha 11, update index note (#6086)
• 26deb23 chore: add modern Netlify to v11.x branch (#6082)
• 7830309 feat: add --fail-hook-affected-tests option to report skipped tests as failed...
• 41f2b95 chore(v11.x): release 11.7.7 (#6068)
• 3477563 fix: surface ts-node compile errors (#6045)
• 3765ba0 chore(v11.x): release 11.7.6 (#5632)
• 73ebdfa fix(test): replace wmic usage with native Windows API (#5694)
• aafe6fd fix: make describe().timeout() work
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.